Packed Attestation in WebAuthn

This document describes the “packed” attestation format as implemented in the oauth2-passkey library, following the WebAuthn specification.

Overview

The “packed” attestation format is commonly used by security keys and provides a compact but comprehensive attestation statement. It supports multiple attestation types: Basic, AttCA (with an attestation certificate), and Self Attestation.

Attestation Statement Format

The “packed” attestation statement follows this structure:

attStmtType = (
    fmt: "packed",
    attStmt: packedStmtFormat
)

packedStmtFormat = {
    alg: COSEAlgorithmIdentifier,
    sig: bytes,
    [x5c: [ attestnCert: bytes, * (caCert: bytes) ]],
    [ecdaaKeyId: bytes]
}

Field Descriptions

fmt: The attestation statement format identifier, which is “packed”.
alg: A COSEAlgorithmIdentifier containing the identifier of the algorithm used to generate the attestation signature.
sig: The attestation signature.
x5c (optional): The attestation certificate and its certificate chain, in X.509 encoding.
ecdaaKeyId (optional): The identifier of the ECDAA key used for the attestation (not supported in current implementation).

Verification Procedure

The verification procedure for “packed” attestation statements follows these steps:

Algorithm and Signature Extraction:
- Extract the algorithm identifier (alg) and signature (sig) from the attestation statement.
Signed Data Construction:
- Concatenate authenticatorData and clientDataHash to form the signed data.
Algorithm Verification:
- Verify that the algorithm is supported (currently only ES256 is supported).
Attestation Type Determination:
- Check for the presence of x5c and ecdaaKeyId to determine the attestation type.
Attestation Verification:
- For Full Attestation (x5c present):
  - Parse and verify the attestation certificate.
  - Verify certificate attributes according to FIDO standards.
  - Verify the signature using the attestation certificate’s public key.
  - Verify the certificate chain if intermediates are present.
- For Self Attestation (neither x5c nor ecdaaKeyId present):
  - Extract the credential public key from authenticatorData.
  - Verify the signature using this public key.
- For ECDAA Attestation (ecdaaKeyId present):
  - Currently not supported.

Certificate Verification

For Full Attestation, the attestation certificate is verified to ensure it meets these requirements:

Basic Constraints: Verify the certificate is not a CA certificate.
AAGUID Verification: If the certificate contains the FIDO AAGUID extension (OID 1.3.6.1.4.1.45724.1.1.4), verify it matches the AAGUID in authenticatorData.

Certificate Chain Verification

If the attestation statement includes intermediate certificates, the library verifies:

Certificate Parsing: Each certificate in the chain can be parsed correctly.
Certificate Validity: Each certificate is currently valid (not expired or not yet valid).

Self Attestation Verification

For Self Attestation, the library:

Extracts the Credential Public Key: From the authenticatorData.
Constructs the Full Public Key: Formats the extracted coordinates as an uncompressed EC point.
Verifies the Signature: Using the credential’s own public key.

Compliance Assessment

The oauth2-passkey library implementation of “packed” attestation has been assessed against the WebAuthn specification requirements. Here’s a summary of the compliance status:

Requirement	Status	Notes
Algorithm Extraction	✅ Compliant	Correctly extracts and verifies the algorithm
Signature Extraction	✅ Compliant	Correctly extracts the signature
Signed Data Construction	✅ Compliant	Properly concatenates authenticatorData and clientDataHash
Algorithm Verification	✅ Compliant	Verifies ES256 algorithm support
Attestation Type Determination	✅ Compliant	Correctly identifies attestation type
Full Attestation Verification	✅ Compliant	Properly verifies certificates and signatures
Self Attestation Verification	✅ Compliant	Correctly extracts and verifies using credential’s own key
Certificate Basic Constraints	✅ Compliant	Verifies certificate is not a CA
AAGUID Verification	✅ Compliant	Matches certificate AAGUID with authenticator AAGUID
Certificate Chain Verification	✅ Compliant	Verifies intermediate certificates when present
ECDAA Attestation	❌ Not Implemented	ECDAA attestation is not currently supported

Areas for Improvement

While the implementation is largely compliant with the WebAuthn specification, there are some areas that could be enhanced:

ECDAA Support: The current implementation does not support ECDAA attestation, which is optional in the WebAuthn specification.
Certificate Verification: More comprehensive certificate verification could be implemented, including checking for revocation status.
Error Handling: More detailed error messages could be provided for specific verification failures.
Performance Optimization: The certificate parsing and verification could potentially be optimized for better performance.

oauth2-passkey Documentation